Modern communication and data networks comprise network nodes, such as routers, switches, bridges, and other devices that transport data through the network. Over the years, the telecommunication industry has made significant improvements to the network nodes to support an increasing number of protocols and specifications standardized by the Internet Engineering Task Force (IETF). Creating and coupling the complex network nodes to form networks that support and implement the various IETF standards (e.g., virtual private network requirements) has cause modern networks to become complex and difficult to manage. As a result, vendors and third-party operators seek to customize, optimize, and improve the performance of the interwoven web of network nodes.
An Information Centric Network (ICN) is a type of network architecture in which the focus is on locating and providing information to users rather than on connecting end hosts that exchange data. One type of ICN is a Content-Oriented Network (CON). In a CON, also referred to as a Content Centric Network (CCN), a content router is responsible for routing user requests and content to proper recipients. The entities may comprise data content, such as video clips or web pages, and/or infrastructure elements, such as routers, switches, or servers.
ICNs go beyond the existing Internet Protocol (IP) networks by shifting the communication model from the current host-to-host model, e.g., the Internet model, to the information-object-to-object model, e.g., the ICN model. In ICN, information objects become the first class abstraction for the entities that exist in the communication model. Information objects are assigned names, and routing to and from such named objects is based on those names. In ICN, an IP address may be treated as a special type of name. Users who want to retrieve the information objects do not need to know where they are located, as distinct from current IP networks where users must specify the destination host's IP address when sending out such requests.
Consequently, ICNs and other content-based Internet architectures use content names or prefixes as routing labels, such that routers route data requests to next hop nodes based on content names, prefixes, or identifications (IDs), embedded in request packets. Without built-in trust verification mechanisms, malicious clients, e.g., botnets, can inject faked prefixes into the network. These malicious acts may consume expensive network resources and degrade or even prevent the access of benign users, e.g., in a denial of service (DoS) or distributed DoS (DDoS) attack directed to one or more components in the network infrastructure, e.g., a router. Other malicious clients may publish content names and/or prefixes of benign publishers of electronic content, preventing users from receiving valid data, e.g., in a DoS attack directed to content providers/owners. Proposed solutions, e.g., rate control with faces and/or prefixes, have proven largely ineffective due to the adaptive behavior of malicious clients, e.g., fictitious names and/or faces, and the potential degradation in the user's quality of experience (QoE) due to increased processing demands.